Pebblestone Asset Management (the “Company”) values the personal information of data subjects and complies with the Personal Information Protection Act and other applicable laws and regulations.

Through this Privacy Policy, the Company provides information on the items of personal information it processes, the purposes of processing, the retention and use period, and the measures taken to safely protect personal information.

This Privacy Policy applies to the website operated by the Company.

If this Privacy Policy is amended, the Company will announce the changes through the website.

This Privacy Policy takes effect as of July 30, 2026.

Article 1 Purpose of Processing Personal Information

The Company processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than those stated below, and if the purpose of processing changes, the Company will take the necessary measures in accordance with applicable laws and regulations.

1. Inquiries

• Receipt of consultations and inquiries
• Responses to and guidance on inquiries
• Review of inquiries and handling of consultation-related work

Article 2 Items of Personal Information Processed

The Company processes the following personal information for inquiries and related purposes.

※ In the course of using the services, information such as IP address, access date and time, and access logs may be automatically generated and collected. If the Company uses such information for a separate personal information processing purpose, the relevant details will be reflected in this Privacy Policy.

Article 3 Processing and Retention Period of Personal Information

After the purpose of collecting and using personal information has been achieved, the Company destroys the relevant personal information without delay.

However, if personal information must be retained for a certain period under applicable laws and regulations, the Company will retain it for the period prescribed by such laws.

Article 4 Procedure and Method of Destruction of Personal Information

If the retention period of personal information has expired or the purpose of processing has been achieved, the Company destroys the relevant personal information without delay.

1. Destruction Procedure
The Company identifies personal information for which a ground for destruction has arisen and destroys it without delay under the management and supervision of the Personal Information Protection Officer.

2. Destruction Method
Personal information stored in electronic file form is deleted using a secure method that prevents recovery or reproduction.
Personal information printed on paper is destroyed by shredding or incineration.

Article 5 Provision of Personal Information to Third Parties

In principle, the Company does not provide a data subject’s personal information to third parties.

However, the following cases are exceptions.

• Where the data subject has given prior consent
• Where there is a special provision in another law
• Where an investigative agency or similar authority makes a request in accordance with the procedures and methods prescribed by law

Article 6 Entrustment of Personal Information Processing

To provide services smoothly, the Company entrusts personal information processing as follows.

When entering into an entrustment agreement, the Company specifies in the agreement the matters necessary to ensure that personal information is managed safely in accordance with the Personal Information Protection Act and other applicable laws, and manages and supervises whether the trustee processes personal information safely.

If the details of the entrusted work or the trustee change, the Company will announce such changes through this Privacy Policy.

Article 7 Overseas Transfer of Personal Information

The Company does not process a data subject’s personal information overseas or transfer it to a third party overseas.

If an overseas transfer of personal information occurs in the future, the Company will announce the matters required under applicable laws through this Privacy Policy.

Article 8 Processing of Personal Information of Children Under 14

In principle, the Company does not separately collect or use the personal information of children under the age of 14.

If it becomes necessary to process the personal information of a child under the age of 14, the Company will obtain the consent of the legal representative and take other necessary measures in accordance with the Personal Information Protection Act and other applicable laws.

Article 9 Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information.

1. Administrative Measures

• Establishment and implementation of an internal management plan for the handling of personal information
• Management and training of employees who handle personal information
• Management of access rights to personal information

2. Technical Measures

• Management of access rights to personal information processing systems and related systems
• Security measures for the safe processing of personal information
• Management of access records to personal information and personal information processing systems
• Installation and periodic updates of security programs

3. Physical Measures

• Access control to locations where personal information is stored
• Management of documents and storage media containing personal information

Article 10 Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

In the course of website use, the Company may use cookies and other automatic collection devices to provide convenience to users and to operate the website stably.

A cookie is a small amount of information that a website transmits to a user’s browser and may be used to maintain the user’s website environment and to understand service usage.

A data subject may allow or refuse the storage of cookies through the settings of their web browser.

However, if the storage of cookies is refused, some functions of the website may be difficult to use.

How to Set Cookies
Cookie-related settings can be changed in the settings menu of your web browser.

• Chrome: Settings → Privacy and security → Third-party cookies
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
• Safari: Settings → Safari → Advanced → Block all cookies

Article 11 Rights and Obligations of Data Subjects and How to Exercise Them

A data subject may at any time exercise the following rights related to the protection of personal information against the Company.

• Request to access personal information
• Request to correct or delete personal information
• Request to suspend the processing of personal information
• Other rights prescribed by the Personal Information Protection Act

A data subject may exercise these rights in writing, by email, or by other means, and the Company will take action without delay in accordance with the procedures prescribed by applicable laws.

These rights may also be exercised through a legal representative or an authorized agent. In such cases, the Company may request documents that can confirm the identity of the data subject or the agent in accordance with applicable laws.

If a request is made to correct or delete personal information, the Company will not use or provide the relevant personal information until the correction or deletion has been completed.

Article 12 Personal Information Protection Officer and Related Inquiries

The Company designates the following Personal Information Protection Officer to take overall responsibility for personal information processing and to handle complaints and provide remedy for data subjects in connection with the processing of personal information.

Article 13 Remedy for Personal Information Infringement

If a report or consultation regarding personal information infringement is needed, a data subject may contact the following organizations.

• Personal Information Infringement Report Center: 118 (no area code)
• Personal Information Dispute Mediation Committee: 1833-6972
• Supreme Prosecutors’ Office: 1301 (no area code)
• Korean National Police Agency: 182 (no area code)

Article 14 Amendment of the Privacy Policy

This Privacy Policy applies from July 30, 2026.

The Company may amend this Privacy Policy in accordance with changes in laws, policies, or the Company’s personal information processing practices. If there are any changes, the Company will announce them through the website.

Effective date: July 30, 2026